# Input Validation

> Flag missing input validation at trust boundaries — user-settable CR fields, webhook payloads, labels, annotations, or untrusted deserialization (CWE-20, CWE-502).

- Skill: `kubernetes-sigs-kueue/input-validation` (Agent Skill)
- Install (CLI): `npx skillmds@latest add kubernetes-sigs-kueue/input-validation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kubernetes-sigs-kueue/input-validation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: Apache-2.0
- Author: kubernetes-sigs (https://skillmd.com/u/kubernetes-sigs-kueue)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/kubernetes-sigs-kueue/input-validation

---


# Skill: Missing Input Validation at Trust Boundaries

- New user-settable fields on a CR, webhook payload, label, or annotation used without
  explicit validation (length, regex, enum, parse).
- Strings from `obj.Spec`, `obj.Annotations`, `obj.Labels`, or webhook request bodies
  consumed directly. Reconciler code must still nil-check optional fields the webhook
  has already validated.
- Untrusted input re-parsed with permissive deserializers
  (`yaml.Unmarshal(..., interface{})`, `gob`, generic JSON into
  `map[string]interface{}`). **Hard violation** (CWE-20, CWE-502).